crimson-falcon 0.3.0 → 0.4.0

data/spec/api/d4c_registration_api_spec.rb

@@ -49,6 +49,17 @@ describe 'D4cRegistrationApi' do
     end
   end
 
+  # unit tests for connect_d4_cgcp_account
+  # Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [RegistrationGCPAccountResponseExtV2]
+  describe 'connect_d4_cgcp_account test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for create_d4_c_aws_account
   # Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
   # @param body
@@ -94,6 +105,17 @@ describe 'D4cRegistrationApi' do
     end
   end
 
+  # unit tests for delete_d4_cgcp_account
+  # Deletes a GCP account from the system.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Array<String>] :ids Hierarchical Resource IDs of accounts
+  # @return [MsaBaseEntitiesResponse]
+  describe 'delete_d4_cgcp_account test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for discover_cloud_azure_download_certificate
   # Returns JSON object(s) that contain the base64 encoded certificate for a service principal.
   # @param tenant_id Azure Tenant ID
@@ -163,6 +185,17 @@ describe 'D4cRegistrationApi' do
     end
   end
 
+  # unit tests for get_d4_cgcp_service_accounts_ext
+  # Returns the service account id and client email for external clients.
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :id Service Account ID
+  # @return [RegistrationGCPServiceAccountResponseExtV1]
+  describe 'get_d4_cgcp_service_accounts_ext test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for get_d4_cgcp_user_scripts
   # Return a script for customer to run in their cloud environment to grant us access to their GCP environment
   # @param [Hash] opts the optional parameters
@@ -174,6 +207,19 @@ describe 'D4cRegistrationApi' do
     end
   end
 
+  # unit tests for get_d4_cgcp_user_scripts_attachment
+  # Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :parent_type GCP Hierarchy Parent Type, organization/folder/project
+  # @option opts [Array<String>] :ids Hierarchical Resource IDs of accounts
+  # @option opts [String] :status Account status to filter results by.
+  # @return [RegistrationGCPProvisionGetUserScriptResponseV1]
+  describe 'get_d4_cgcp_user_scripts_attachment test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for get_discover_cloud_azure_account
   # Return information about Azure account registration
   # @param [Hash] opts the optional parameters
@@ -216,6 +262,7 @@ describe 'D4cRegistrationApi' do
   # @param [Hash] opts the optional parameters
   # @option opts [Array<String>] :subscription_ids Azure Subscription ID
   # @option opts [String] :template Template to be rendered
+  # @option opts [Boolean] :azure_management_group Use Azure Management Group
   # @return [RegistrationAzureProvisionGetUserScriptResponseV1]
   describe 'get_discover_cloud_azure_user_scripts_attachment test' do
     it 'should work' do

data/spec/api/drift_indicators_api_spec.rb

@@ -0,0 +1,114 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for Falcon::DriftIndicatorsApi
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'DriftIndicatorsApi' do
+  before do
+    # run before each test
+    @api_instance = Falcon::DriftIndicatorsApi.new
+  end
+
+  after do
+    # run after each test
+  end
+
+  describe 'test an instance of DriftIndicatorsApi' do
+    it 'should create an instance of DriftIndicatorsApi' do
+      expect(@api_instance).to be_instance_of(Falcon::DriftIndicatorsApi)
+    end
+  end
+
+  # unit tests for get_drift_indicators_values_by_date
+  # Returns the count of Drift Indicators by the date. by default it's for 7 days.
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :filter Filter drift indicators using a query in Falcon Query Language (FQL). Supported filters: cid,cloud_name,command_line,container_id,file_name,file_sha256,host_id,indicator_process_id,namespace,occurred_at,parent_process_id,pod_name,prevented,scheduler_name,severity,worker_node_name
+  # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+  # @return [DriftindicatorsDriftIndicatorsFieldValue]
+  describe 'get_drift_indicators_values_by_date test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for read_drift_indicator_entities
+  # Retrieve Drift Indicator entities identified by the provided IDs
+  # @param [Hash] opts the optional parameters
+  # @option opts [Array<String>] :ids Search Drift Indicators by ids - The maximum amount is 100 IDs
+  # @return [DriftindicatorsDriftEntityResponse]
+  describe 'read_drift_indicator_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for read_drift_indicators_count
+  # Returns the total count of Drift indicators over a time period
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :filter Filter images using a query in Falcon Query Language (FQL). Supported filters:  cid,cloud_name,command_line,container_id,file_name,file_sha256,host_id,indicator_process_id,namespace,occurred_at,parent_process_id,pod_name,prevented,scheduler_name,severity,worker_node_name
+  # @return [DriftindicatorsDriftIndicatorsCountValue]
+  describe 'read_drift_indicators_count test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for search_and_read_drift_indicator_entities
+  # Retrieve Drift Indicators by the provided search criteria
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :filter Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filters:  cid, cloud_name, command_line, container_id, file_name, file_sha256, host_id, indicator_process_id, namespace, occurred_at, parent_process_id, pod_name, prevented, scheduler_name, severity, worker_node_name
+  # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+  # @option opts [Integer] :offset The offset from where to begin.
+  # @option opts [String] :sort The fields to sort the records on.
+  # @return [DriftindicatorsDriftEntityResponse]
+  describe 'search_and_read_drift_indicator_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for search_drift_indicators
+  # Retrieve all drift indicators that match the given query
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :filter Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filters:  cid, cloud_name, command_line, container_id, file_name, file_sha256, host_id, indicator_process_id, namespace, occurred_at, parent_process_id, pod_name, prevented, scheduler_name, severity, worker_node_name
+  # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+  # @option opts [Integer] :offset The offset from where to begin.
+  # @option opts [String] :sort The fields to sort the records on.
+  # @return [MsaspecQueryResponse]
+  describe 'search_drift_indicators test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end

data/spec/api/falcon_complete_dashboard_api_spec.rb

@@ -49,6 +49,17 @@ describe 'FalconCompleteDashboardApi' do
     end
   end
 
+  # unit tests for aggregate_alerts
+  # Retrieve aggregate alerts values based on the matched filter
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [MsaAggregatesResponse]
+  describe 'aggregate_alerts test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for aggregate_allow_list
   # Retrieve aggregate allowlist ticket values based on the matched filter
   # @param body
@@ -116,6 +127,17 @@ describe 'FalconCompleteDashboardApi' do
     end
   end
 
+  # unit tests for aggregate_prevention_policy
+  # Retrieve prevention policies aggregate values based on the matched filter
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [MsaAggregatesResponse]
+  describe 'aggregate_prevention_policy test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for aggregate_remediations
   # Retrieve aggregate remediation ticket values based on the matched filter
   # @param body
@@ -127,6 +149,28 @@ describe 'FalconCompleteDashboardApi' do
     end
   end
 
+  # unit tests for aggregate_sensor_update_policy
+  # Retrieve sensor update policies aggregate values
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [MsaAggregatesResponse]
+  describe 'aggregate_sensor_update_policy test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for aggregate_total_device_counts
+  # Retrieve aggregate total host/devices based on the matched filter
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [MsaAggregatesResponse]
+  describe 'aggregate_total_device_counts test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for get_device_count_collection_queries_by_filter
   # Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
   # @param [Hash] opts the optional parameters
@@ -134,13 +178,27 @@ describe 'FalconCompleteDashboardApi' do
   # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \"asc\" or \"desc\".
   # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see [our FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
   # @option opts [String] :offset Starting index of overall result set from which to return ids.
-  # @return [MsaQueryResponse]
+  # @return [MsaspecQueryResponse]
   describe 'get_device_count_collection_queries_by_filter test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
+  # unit tests for query_alert_ids_by_filter
+  # Retrieve Alerts Ids that match the provided FQL filter criteria with scrolling enabled
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :limit The maximum records to return. [1-500]
+  # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \"asc\" or \"desc\".
+  # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see [our FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
+  # @option opts [String] :offset Starting index of overall result set from which to return ids.
+  # @return [MsaspecQueryResponse]
+  describe 'query_alert_ids_by_filter test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for query_allow_list_filter
   # Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled
   # @param [Hash] opts the optional parameters
@@ -148,7 +206,7 @@ describe 'FalconCompleteDashboardApi' do
   # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \"asc\" or \"desc\".
   # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see [our FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
   # @option opts [String] :offset Starting index of overall result set from which to return ids.
-  # @return [MsaQueryResponse]
+  # @return [MsaspecQueryResponse]
   describe 'query_allow_list_filter test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
@@ -162,7 +220,7 @@ describe 'FalconCompleteDashboardApi' do
   # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \"asc\" or \"desc\".
   # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see [our FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
   # @option opts [String] :offset Starting index of overall result set from which to return ids.
-  # @return [MsaQueryResponse]
+  # @return [MsaspecQueryResponse]
   describe 'query_block_list_filter test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
@@ -176,7 +234,7 @@ describe 'FalconCompleteDashboardApi' do
   # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \"asc\" or \"desc\".
   # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see [our FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
   # @option opts [String] :offset Starting index of overall result set from which to return ids.
-  # @return [MsaQueryResponse]
+  # @return [MsaspecQueryResponse]
   describe 'query_detection_ids_by_filter test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
@@ -190,7 +248,7 @@ describe 'FalconCompleteDashboardApi' do
   # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \"asc\" or \"desc\".
   # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see [our FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
   # @option opts [String] :offset Starting index of overall result set from which to return ids.
-  # @return [MsaQueryResponse]
+  # @return [MsaspecQueryResponse]
   describe 'query_escalations_filter test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
@@ -204,7 +262,7 @@ describe 'FalconCompleteDashboardApi' do
   # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \"asc\" or \"desc\".
   # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see [our FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
   # @option opts [String] :offset Starting index of overall result set from which to return ids.
-  # @return [MsaQueryResponse]
+  # @return [MsaspecQueryResponse]
   describe 'query_incident_ids_by_filter test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
@@ -218,7 +276,7 @@ describe 'FalconCompleteDashboardApi' do
   # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \"asc\" or \"desc\".
   # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see [our FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
   # @option opts [String] :offset Starting index of overall result set from which to return ids.
-  # @return [MsaQueryResponse]
+  # @return [MsaspecQueryResponse]
   describe 'query_remediations_filter test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/

data/spec/api/falcon_container_image_api_spec.rb

@@ -71,20 +71,6 @@ describe 'FalconContainerImageApi' do
     end
   end
 
-  # unit tests for get_combined_images
-  # Get image assessment results by providing an FQL filter and paging details
-  # @param [Hash] opts the optional parameters
-  # @option opts [String] :filter Filter images using a query in Falcon Query Language (FQL). Supported filters:  container_running_status, cve_id, first_seen, registry, repository, tag, vulnerability_severity
-  # @option opts [Integer] :limit The upper-bound on the number of records to retrieve [1-100]
-  # @option opts [Integer] :offset The offset from where to begin.
-  # @option opts [String] :sort The fields to sort the records on. Supported columns:  [first_seen registry repository tag vulnerability_severity]
-  # @return [ImagesExtCombinedImagesResponse]
-  describe 'get_combined_images test' do
-    it 'should work' do
-      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
-    end
-  end
-
   # unit tests for read_registry_entities
   # Retrieve registry entities identified by the customer id
   # @param [Hash] opts the optional parameters

data/spec/api/falconx_sandbox_api_spec.rb

@@ -209,7 +209,7 @@ describe 'FalconxSandboxApi' do
 
   # unit tests for submit
   # Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
-  # @param body Submit either a URL or a sample SHA256 for sandbox analysis. The sample file must have been previously uploaded through `/samples/entities/samples/v2`. You must specify a JSON object that includes the `falconx.SubmissionParametersV1` key/value pairs shown below.  **`environment_id`**: Specifies the sandbox environment used for analysis. Values:  - `300`: Linux Ubuntu 16.04, 64-bit - `200`: Android (static analysis) - `160`: Windows 10, 64-bit - `110`: Windows 7, 64-bit - `100`: Windows 7, 32-bit  **`sha256`** ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with `/falconx/queries/submissions/v1`.The `url` parameter must be unset if `sha256` is used.  **`url`** A web page or file URL. It can be HTTP(S) or FTP. The `sha256` parameter must be unset if `url` is used.  **`action_script`** (optional): Runtime script for sandbox analysis. Values:  - `default` - `default_maxantievasion` - `default_randomfiles` - `default_randomtheme` - `default_openie`  **`command_line`** (optional): Command line script passed to the submitted file at runtime. Max length: 2048 characters  **`document_password`** (optional): Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters  **`enable_tor`** (optional): Deprecated, please use `network_settings` instead. If `true`, sandbox analysis routes network traffic via TOR. Default: `false`.  **`network_settings`** (optional): Specifies the sandbox network_settings used for analysis. Values:  - `default`: Fully operating network - `tor`: Route network traffic via TOR - `simulated`: Simulate network traffic - `offline`: No network traffic  **`submit_name`** (optional): Name of the malware sample that's used for file type detection and analysis  **`system_date`** (optional): Set a custom date in the format `yyyy-MM-dd` for the sandbox environment  **`system_time`** (optional): Set a custom time in the format `HH:mm` for the sandbox environment.
+  # @param body Submit either a URL or a sample SHA256 for sandbox analysis. The sample file must have been previously uploaded through `/samples/entities/samples/v2`. You must specify a JSON object that includes the `falconx.SubmissionParametersV1` key/value pairs shown below.  **`environment_id`**: Specifies the sandbox environment used for analysis. Values:  - `400`: MacOS Catalina 10.15 - `300`: Linux Ubuntu 16.04, 64-bit - `200`: Android (static analysis) - `160`: Windows 10, 64-bit - `140`: Windows 11, 64-bit - `110`: Windows 7, 64-bit - `100`: Windows 7, 32-bit  **`sha256`** ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with `/falconx/queries/submissions/v1`.The `url` parameter must be unset if `sha256` is used.  **`url`** A web page or file URL. It can be HTTP(S) or FTP. The `sha256` parameter must be unset if `url` is used.  **`action_script`** (optional): Runtime script for sandbox analysis. Values:  - `default` - `default_maxantievasion` - `default_randomfiles` - `default_randomtheme` - `default_openie`  **`command_line`** (optional): Command line script passed to the submitted file at runtime. Max length: 2048 characters  **`document_password`** (optional): Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters  **`enable_tor`** (optional): Deprecated, please use `network_settings` instead. If `true`, sandbox analysis routes network traffic via TOR. Default: `false`.  **`network_settings`** (optional): Specifies the sandbox network_settings used for analysis. Values:  - `default`: Fully operating network - `tor`: Route network traffic via TOR - `simulated`: Simulate network traffic - `offline`: No network traffic  **`submit_name`** (optional): Name of the malware sample that's used for file type detection and analysis  **`system_date`** (optional): Set a custom date in the format `yyyy-MM-dd` for the sandbox environment  **`system_time`** (optional): Set a custom time in the format `HH:mm` for the sandbox environment.
   # @param [Hash] opts the optional parameters
   # @return [FalconxSubmissionV1Response]
   describe 'submit test' do